Static task
static1
Behavioral task
behavioral1
Sample
4d2ba637ad1acd92d30e1a8040243a6c_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4d2ba637ad1acd92d30e1a8040243a6c_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
4d2ba637ad1acd92d30e1a8040243a6c_JaffaCakes118
-
Size
2.8MB
-
MD5
4d2ba637ad1acd92d30e1a8040243a6c
-
SHA1
02e60d55ccbceec8b5a3d07fa74a70e88bb27063
-
SHA256
0a76f3837bdb3b82e0a37af4d76655c28a3f3da6c47bf9dfdae49fa2e0b455da
-
SHA512
14b2ce80df8b750ebbc75ccf36d761aad48f85c3d8e372374d27b28db5b346b474b1e9b3c2c5710080432cfbd1796ab52531a7bbbb80db235b2f2ac6a0d893a7
-
SSDEEP
24576:JGDGis8fLli6df6tnVtt4SUjrJil3h8uAGJZT91M3cOqRAyYDfdYc:Ja48fZP0ht4nilbZj7BAyYDfdl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d2ba637ad1acd92d30e1a8040243a6c_JaffaCakes118
Files
-
4d2ba637ad1acd92d30e1a8040243a6c_JaffaCakes118.exe windows:5 windows x86 arch:x86
1569d5225a8e597511bcf3b40686df6f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SwitchToThread
SetFilePointerEx
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
FlushViewOfFile
OpenEventW
VirtualAlloc
CreateFileW
GetFileAttributesW
GetFileAttributesExW
FindNextFileW
CreateJobObjectW
LCMapStringW
GetModuleHandleW
GlobalAlloc
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
HeapReAlloc
HeapAlloc
GetStringTypeW
OutputDebugStringW
RtlUnwind
LoadLibraryExW
HeapFree
GetCommandLineW
RaiseException
IsProcessorFeaturePresent
EncodePointer
GetLastError
SetLastError
GetCurrentThreadId
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
CloseHandle
advapi32
RegSetValueExW
secur32
InitializeSecurityContextW
FreeContextBuffer
GetUserNameExW
TranslateNameW
DeleteSecurityContext
user32
DrawTextW
TrackPopupMenuEx
DeleteMenu
IsDlgButtonChecked
RemovePropW
SetWindowPos
SendMessageW
DispatchMessageW
GetKeyboardLayoutList
ActivateKeyboardLayout
LoadIconW
DestroyIcon
GetIconInfo
DeferWindowPos
wtsapi32
WTSEnumerateSessionsW
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 507KB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vd9tl4 Size: 546KB - Virtual size: 546KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.b2r2a Size: 352KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.05ly Size: 670KB - Virtual size: 669KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.g5hr Size: 326KB - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ